当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-082888

漏洞标题:优酷某后台逻辑问题导致内部员工信息部分泄漏(还可撞库)

相关厂商:优酷

漏洞作者: 子非海绵宝宝

提交时间:2014-11-11 16:52

修复时间:2014-12-26 16:54

公开时间:2014-12-26 16:54

漏洞类型:设计缺陷/逻辑错误

危害等级:低

自评Rank:5

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-11-11: 细节已通知厂商并且等待厂商处理中
2014-11-11: 厂商已经确认,细节仅向厂商公开
2014-11-21: 细节向核心白帽子及相关领域专家公开
2014-12-01: 细节向普通白帽子公开
2014-12-11: 细节向实习白帽子公开
2014-12-26: 细节向公众公开

简要描述:

RT

详细说明:

问题出在MCenter登录验证系统
通过员工的手机邮箱帐号来发送密码只手机或者邮箱
但是问题就来了
这个接口没有做验证,可以加进行撞库测试帐号并且可以在成功提交后得知帐号邮箱手机对应的员工名字手机部分信息和完整优酷邮箱

1.jpg


2.jpg

漏洞证明:

mask 区域
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****9 jcheng@tudo*****
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****[email protected].*****
***** haofeng@youku*****
*****angyang85@youku*****
*****[email protected] y*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] sham*****
*****[email protected]*****
*****[email protected] tia*****
*****[email protected]*****
*****[email protected].*****
*****weiwang@tudou.*****
*****[email protected] *****
*****xian.youku.com de*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] x*****
*****[email protected]*****
*****[email protected] w*****
*****[email protected] *****
*****[email protected]*****
*****[email protected].*****
*****[email protected] wa*****
*****[email protected] *****
*****[email protected] l*****
*****[email protected] s*****
*****[email protected] *****
*****[email protected] lanf*****
*****[email protected] lov*****
*****[email protected] c*****
*****[email protected].*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] E*****
*****[email protected]*****
*****youku.com love*****
*****[email protected]*****
*****[email protected] *****
*****[email protected] c*****
*****[email protected] se*****
*****[email protected] ab*****
*****[email protected] das*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] zh*****
*****[email protected] lcja*****
*****[email protected] m*****
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] s*****
*****[email protected] rich*****
*****[email protected] hell*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] b*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] *****
*****[email protected] lm*****
*****[email protected] l*****
*****[email protected] r*****
*****[email protected]*****
*****[email protected] ma*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] la*****
*****[email protected] li*****
*****[email protected]*****
*****[email protected] m*****
*****[email protected] dd*****
*****[email protected] xi*****
*****@xian.youku.com aa*****
*****[email protected]*****
*****[email protected] m*****
*****[email protected] wozh*****
*****hangguoqiang@youku.*****
*****[email protected] w*****
*****[email protected].*****
*****[email protected] ai*****
*****[email protected] l*****
*****[email protected] tm*****
*****[email protected]*****
*****[email protected] *****
*****[email protected]*****
*****[email protected] *****
*****[email protected] ma*****
*****[email protected].*****
*****[email protected] ci*****
*****[email protected] su*****
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] y12*****
*****[email protected]*****
***** liulibin@youku*****
*****[email protected] h*****
*****@xian.youku.com gi*****
*****[email protected] Re*****
*****[email protected] li*****
*****[email protected]*****
*****[email protected] *****
*****youku.com datouha*****
*****nliangliang@youku.*****
*****[email protected]*****
*****[email protected].*****
*****[email protected]*****
*****xian.youku.com su*****
*****[email protected] cco*****
*****[email protected] lucas_*****
*****[email protected]*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] wu*****
*****[email protected] l*****
*****[email protected] *****
*****tudou.com ZHONGWAN*****
*****[email protected] ta*****
*****[email protected] n*****
*****[email protected]*****
*****[email protected].*****
*****[email protected] Cap*****
*****[email protected] rain*****
*****[email protected] bjzh*****
*****[email protected] u*****
*****[email protected] g*****
*****[email protected] lo*****
*****tangjun@youku.*****
*****[email protected] *****
*****youku.com lili_*****
*****[email protected] nic*****
*****[email protected] w*****
*****[email protected]*****
*****[email protected] mi*****
*****[email protected] r*****
*****[email protected] po0*****
*****[email protected]*****
*****[email protected]*****
*****tudou.com hahaha*****
*****[email protected] s*****
*****[email protected]*****
*****tangjun@youku.*****
*****[email protected]*****
*****[email protected]*****
*****[email protected] wan*****


上面就是稍微撞了下出来的信息
有了这些信息可以杜工之类的

修复方案:

做好接口验证

版权声明:转载请注明来源 子非海绵宝宝@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2014-11-11 16:58

厂商回复:

多谢提醒,马上修复。

最新状态:

暂无